apiVersion: apps/v1
kind: Deployment
metadata:
  name: stalwart
  namespace: stalwart
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 0
  selector:
    matchLabels:
      app.kubernetes.io/name: stalwart
      app.kubernetes.io/instance: stalwart
  template:
    metadata:
      annotations:
        quorate.internal/configuration-revision: 712f9ab87e927320c07127aadb44f41bdbcce7f7e34c56b7c67179efefb80f0e
      labels:
        app.kubernetes.io/name: stalwart
        app.kubernetes.io/instance: stalwart
        quorate.dev/zitadel-relay: "true"
    spec:
      serviceAccountName: stalwart
      automountServiceAccountToken: false
      runtimeClassName: gvisor
      securityContext:
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          minDomains: 2
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: stalwart
              app.kubernetes.io/instance: stalwart
      initContainers:
        - name: trust-bundle
          image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
            - -ec
          args:
            - cat /etc/ssl/certs/ca-certificates.crt /run/runtime/internal_ca_cert > /run/trust/ca-certificates.crt
          securityContext:
            runAsNonRoot: true
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 5m
              memory: 8Mi
            limits:
              cpu: 50m
              memory: 16Mi
          volumeMounts:
            - name: runtime
              mountPath: /run/runtime
              readOnly: true
            - name: trust
              mountPath: /run/trust
        - name: wait-zitadel
          image: registry.quorate.internal/quorate/stalwart-controller:delivery-318c46b68e20be4d793a344ea1e5464e436edbaa@sha256:70704960a5bf3eb8398c8f26ecaefe7341faa2e7e65c16fa3c40a8e13c94b7dd
          imagePullPolicy: IfNotPresent
          args:
            - wait-oidc
            - /run/oidc/issuer_url
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            runAsGroup: 65532
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 10m
              memory: 16Mi
            limits:
              cpu: 100m
              memory: 32Mi
          volumeMounts:
            - name: oidc
              mountPath: /run/oidc
              readOnly: true
      containers:
        - name: stalwart
          image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
          imagePullPolicy: IfNotPresent
          args:
            - --config
            - /etc/stalwart/config.json
          env:
            - name: SSL_CERT_FILE
              value: /run/trust/ca-certificates.crt
            - name: STALWART_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: stalwart-db
                  key: password
            - name: STALWART_S3_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: stalwart-runtime
                  key: s3_secret_key
            - name: STALWART_CACHE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: stalwart-runtime
                  key: dragonfly_password
            - name: STALWART_RELAY_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: stalwart-delivery
                  key: relay_password
          ports:
            - name: management
              containerPort: 8080
            - name: user-http
              containerPort: 8081
            - name: smtp
              containerPort: 25
            - name: submissions
              containerPort: 465
            - name: submission
              containerPort: 587
            - name: imaps
              containerPort: 993
          startupProbe:
            httpGet:
              path: /healthz/live
              port: management
            failureThreshold: 90
            periodSeconds: 2
          livenessProbe:
            httpGet:
              path: /healthz/live
              port: management
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz/live
              port: management
            periodSeconds: 5
          securityContext:
            runAsNonRoot: true
            runAsUser: 2000
            runAsGroup: 2000
            allowPrivilegeEscalation: false
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          volumeMounts:
            - name: startup
              mountPath: /etc/stalwart/config.json
              subPath: config.json
              readOnly: true
            - name: runtime
              mountPath: /run/runtime
              readOnly: true
            - name: tls
              mountPath: /run/tls
              readOnly: true
            - name: trust
              mountPath: /run/trust
              readOnly: true
            - name: tmp
              mountPath: /tmp
        - name: account-web
          image: registry.quorate.internal/quorate/mail-keys@sha256:447051628ca4aa92371acb83092f323047eab961a45140ef0877a3495ec2d98a
          imagePullPolicy: IfNotPresent
          ports:
            - name: account-http
              containerPort: 8082
              protocol: TCP
            - name: user-https
              containerPort: 8443
              protocol: TCP
          startupProbe:
            tcpSocket:
              port: user-https
            failureThreshold: 30
            periodSeconds: 2
          readinessProbe:
            httpGet:
              path: /account/oauth/callback
              port: 8443
              scheme: HTTPS
              httpHeaders:
                - name: Host
                  value: mail.quorate.dev
            periodSeconds: 5
          livenessProbe:
            tcpSocket:
              port: user-https
            periodSeconds: 15
          securityContext:
            runAsNonRoot: true
            runAsUser: 65532
            runAsGroup: 65532
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              memory: 64Mi
          volumeMounts:
            - name: account-config
              mountPath: /run/config
              readOnly: true
            - name: tls
              mountPath: /run/tls
              readOnly: true
            - name: nginx-tmp
              mountPath: /tmp
      volumes:
        - name: account-config
          secret:
            secretName: mail-web
            defaultMode: 0440
            items:
              - key: config.json
                path: config.json
        - name: startup
          configMap:
            name: startup
        - name: runtime
          secret:
            secretName: stalwart-runtime
            defaultMode: 0440
        - name: tls
          secret:
            secretName: stalwart-tls
            defaultMode: 0440
        - name: oidc
          secret:
            secretName: stalwart-oidc
            defaultMode: 0440
        - name: tmp
          emptyDir: {}
        - name: nginx-tmp
          emptyDir: {}
        - name: trust
          emptyDir: {}